Emilce, Jamila, Brenda, & Luxi - pEtsy - Octos #20
Conversation
…lt status to order.
…e. Updated the controller and model for review
…t a product from other user.
…gits in the orders show page.
bEtsyWhat We're Looking For
Only the person who submitted the PR will get an email about this feedback. Please let the rest of your team know about it. |
| <%= f.text_area :cc_cvv %> | ||
|
|
||
| <%= f.label :bill_zip, "BILLING ZIP CODE" %> | ||
| <%= f.text_area :bill_zip %> |
There was a problem hiding this comment.
Why are these text_areas? You don't need the extra space, and this will prevent the form from submitting with <enter>.
| <div class="container"> | ||
|
|
||
| <h2>Merchant: <%= link_to @product.user_id, user_path %></h2> | ||
|
|
There was a problem hiding this comment.
This link points to the wrong place - since you don't pass a parameter to user_path, it takes the ID from the current page, but that's the product ID. Instead you probably want: link_to @product.user.name, user_path(@product.user)
| def new | ||
| if session[:user_id] | ||
| @product = Product.new(user_id: params[:user_id]) | ||
| else |
There was a problem hiding this comment.
On line 16 you check for the user ID in the session, but on line 17 you try to pull it out of the params. This means that the product isn't getting assigned to the user correctly, because params[:user_id] is nil, which breaks a lot of the other functionality of the site.
| def create | ||
| @category = Category.new(category_params) | ||
| @category.save | ||
| redirect_to users_path |
There was a problem hiding this comment.
You don't check the return value of save here. What if the user entered a blank category name and it fails your validations?
There was a problem hiding this comment.
You're also not checking that the user is logged in here, which means that an unauthenticated user with a tool like Postman could create as many categories as they want.
| def new | ||
| if current_user | ||
| @category = Category.new | ||
| else |
There was a problem hiding this comment.
Instead of checking that the user is logged in manually, you should use a controller filter like we did in class. That will both help keep this code DRY, and prevent you from accidentally letting a user do something they shouldn't (like with create below)
| it "sends success if the order exists" do | ||
| order = Order.first | ||
| orderitem_data = { product_id: Product.first.id, quantity: Product.first.stock, order_id: order.id } | ||
|
|
There was a problem hiding this comment.
You should probably have tests for both adding a new product to the cart, and adding a product that's already in the cart (update the quantity)
|
|
||
| it "does not procees the order if the customer data is incomplete" do | ||
| orderitem = {product_id: Product.first.id, quantity: Product.first.stock} | ||
| post order_items_path, params: {order_item: orderitem} |
There was a problem hiding this comment.
You should also test that it doesn't go through if orderitem quantities are invalid, and that it reduces the stock of each of those products.
|
|
||
| def product_params | ||
| params.require(:product).permit(:name, :stock, :price, :description, :pet_type, :photo_url, :user_id, category_ids: []) | ||
| end |
There was a problem hiding this comment.
You should take the user ID from the session, not from the form data. That would allow a logged-in user to add products for some other user, or even to change which user a product is associated with.
|
|
||
| describe "show" do | ||
| it 'sends success if the product exists' do | ||
| get product_path(Product.first) |
There was a problem hiding this comment.
Missing tests for edit, update and destroy. These are particularly interesting ones, since there are 3 key test cases around authorization:
- Guest user
- Wrong user logged in
- Right user logged in
| describe "create" do | ||
|
|
||
| it "it won't create a review with bogus data" do | ||
| product = Product.create(name:"cat rug",price: 10, user: users(:one), stock: 15) |
There was a problem hiding this comment.
What if you try to create a review when logged in as that product's owner?
bEtsy
Congratulations! You're submitting your assignment! These comprehension questions should be answered by all members of your team, not by a single teammate.
Comprehension Questions